Overview

overview

10

Static

static

malware.exe

windows11_x64

10

malware.exe

windows10_x64

10

Resubmissions

21-10-2021 11:49

211021-nzczcsacb2 10

20-10-2021 14:55

211020-sagcpshbf9 10

19-10-2021 14:57

211019-sb3bkaghgn 10

19-10-2021 14:24

211019-rqq2eagab5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    malware.exe

  • Size

    11MB

  • Sample

    211020-sagcpshbf9

  • MD5

    5544ca0d55ecf9e4f1a738f01bcebe84

  • SHA1

    54cf5562fd1e992baff6060f5262cecf5449fe1c

  • SHA256

    37aa2beb667b66b5b548722f4a5b7c72d01b191c538e4ad1acb9467cbc5d8727

  • SHA512

    676bd327e881bfea4134e60c97cf67fb500dc261d2e3515762ed098e9e56eb558fbec159a1af593aafcdb53f4892e33a5a28fe895be89a9f90c340cde68ba71f

Score
10/10
amadeyazorultraccoonredlinesmokeloadersocelarsvidarxmrig10282f2ad1a1aa093c5a9d17040c8efd5650a99640b57c9b4504a63ed23664e38808e65948379b790395937fucker2media18aspackv2backdoordiscoveryevasionexploitinfostealerminerpersistencespywarestealerthemidatrojan

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Extracted

Family

azorult
C2

http://kvaka.li/1210776429.php

Extracted

Family

smokeloader
Version

2020
C2

http://gejajoo7.top/

http://sysaheu9.top/
rc4.i32
rc4.i32

Extracted

Family

redline
Botnet

media18
C2

91.121.67.60:2151

Extracted

Family

vidar
Version

41.5
Botnet

937
C2

https://mas.to/@xeroxxx
Attributes
profile_id
937

Extracted

Family

redline
Botnet

fucker2
C2

135.181.129.119:4805

Extracted

Family

raccoon
Botnet

2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
Attributes
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
rc4.plain
rc4.plain

Extracted

Family

vidar
Version

41.5
Botnet

1028
C2

https://mas.to/@xeroxxx
Attributes
profile_id
1028

Extracted

Family

raccoon
Botnet

7c9b4504a63ed23664e38808e65948379b790395
Attributes
url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar
rc4.plain
rc4.plain

Targets

    • Target

      malware.exe

    • Size

      11MB

    • MD5

      5544ca0d55ecf9e4f1a738f01bcebe84

    • SHA1

      54cf5562fd1e992baff6060f5262cecf5449fe1c

    • SHA256

      37aa2beb667b66b5b548722f4a5b7c72d01b191c538e4ad1acb9467cbc5d8727

    • SHA512

      676bd327e881bfea4134e60c97cf67fb500dc261d2e3515762ed098e9e56eb558fbec159a1af593aafcdb53f4892e33a5a28fe895be89a9f90c340cde68ba71f

    Score
    10/10
    amadeyazorultraccoonsmokeloadersocelarsvidarxmrigbackdoordiscoveryevasionexploitinfostealerminerpersistencespywarestealertrojanredline10282f2ad1a1aa093c5a9d17040c8efd5650a99640b57c9b4504a63ed23664e38808e65948379b790395937fucker2media18aspackv2themida

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

      trojanamadey

    • Azorult

      An information stealer that was first discovered in 2016, targeting browsing history and passwords.

      trojaninfostealerazorult

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Raccoon

      Simple but powerful infostealer which was very active in 2019.

      stealerraccoon

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine Payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars Payload

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Vidar

      Vidar is an infostealer based on Arkei stealer.

      stealervidar

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Vidar Stealer

      stealer

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Possible privilege escalation attempt

      exploit

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

Command and Control

    Credential Access

    Defense Evasion

    Discovery

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

              Privilege Escalation

                Tasks